@ardennguyen/zalo-agent-cli 2.5.0 → 2.5.3

package/src/mcp/mcp-tools.js

@@ -1,10 +1,10 @@
 /**
  * MCP tool registrations for Zalo message access, sending, user lookup, and group productivity.
- * Registers 23 tools: zalo_get_messages, zalo_get_history, zalo_send_message, zalo_list_threads,
+ * Registers 25 tools: zalo_get_messages, zalo_get_history, zalo_send_message, zalo_list_threads,
  * zalo_search_threads, zalo_mark_read, zalo_view_media, zalo_react, zalo_undo, zalo_get_group_members,
  * zalo_list_conversations, zalo_coverage, zalo_sync, zalo_sync_status, zalo_search_messages,
  * zalo_lookup_user, zalo_forward_message, zalo_delete_message, zalo_reminder, zalo_note, zalo_poll,
- * zalo_wait_for_message, zalo_label.
+ * zalo_wait_for_message, zalo_label, zalo_friend, zalo_group.
  *
  * A tool that mirrors a CLI command calls the same code the command does (src/core/cached-message.js,
  * forward.js, pin.js, group-members.js, recent-conversations.js, src/utils/my-documents.js, urgency.js),
@@ -47,6 +47,23 @@ import { expandMentions, ALL_MENTION_UID } from "../utils/mentions.js";
 import { resolveSelfThread } from "../utils/my-documents.js";
 import { buildQuote, resolveQuoteSender } from "../utils/quote.js";
 import { urgencyLevel } from "../utils/urgency.js";
+import {
+    describeFriendAddError,
+    extractErrorCode,
+    friendStatusFrom,
+    friendsFrom,
+    receivedRequestsFrom,
+    sentRequestsFrom,
+} from "../core/friend-requests.js";
+import {
+    CONFIRMED_ACTIONS,
+    NOT_A_MEMBER_CODES,
+    REMOVE_NOT_IN_GROUP,
+    createdGroupFrom,
+    groupConfirmRequired,
+    groupInfoFrom,
+    memberChangeFrom,
+} from "../core/group-admin.js";
 import { resolveCurrentUserNames, withCurrentSenderNames } from "../core/current-user-names.js";
 
 /** Repeat mode codes matching zca-js ReminderRepeatMode enum and src/commands/reminder.js. */
@@ -460,8 +477,8 @@ export function registerTools(server, api, buffer, filter, config, nameCache, ac
         {
             title: "Send Zalo Message",
             description:
-                "Send a text message, link preview card (`link`), or contact card (`cardUserId`) to a Zalo thread " +
-                "(DM or group). threadType: 0=DM(User), 1=Group. " +
+                "Send a text message, file/image attachment (`filePath` or `files`), link preview card (`link`), or " +
+                "contact card (`cardUserId`) to a Zalo thread (DM or group). threadType: 0=DM(User), 1=Group. " +
                 "To @-mention someone in a group, put `@[uid]` in the text where the tag belongs — " +
                 "`@[123456]` becomes `@Their Name` and notifies them, and `@[-1]` is @All. " +
                 "Use the `senderId` from zalo_get_messages or zalo_get_history as the uid; the display name " +
@@ -481,8 +498,22 @@ export function registerTools(server, api, buffer, filter, config, nameCache, ac
                         .min(1)
                         .optional()
                         .describe(
-                            "Message text to send (required unless `link` or `cardUserId` is set; optional caption when `link` is set). " +
-                                "`@[uid]` tokens expand to @-mentions; `@[-1]` is @All.",
+                            "Message text to send (required unless `filePath`, `files`, `link`, or `cardUserId` is set; " +
+                                "optional caption when `filePath`, `files`, or `link` is set). `@[uid]` tokens expand to @-mentions; `@[-1]` is @All.",
+                        ),
+                    filePath: z
+                        .string()
+                        .min(1)
+                        .optional()
+                        .describe(
+                            "Optional local file or image path to send as an attachment (uses `text` as optional caption)",
+                        ),
+                    files: z
+                        .array(z.string().min(1))
+                        .min(1)
+                        .optional()
+                        .describe(
+                            "Optional list of local file or image paths to send as attachments in one call (uses `text` as optional caption)",
                         ),
                     link: z
                         .string()
@@ -520,17 +551,27 @@ export function registerTools(server, api, buffer, filter, config, nameCache, ac
                         ),
                 })
                 .refine(
-                    (val) => Boolean(val.text || val.link || val.cardUserId),
-                    "Provide at least one of text, link, or cardUserId",
+                    (val) =>
+                        Boolean(
+                            val.text ||
+                            val.link ||
+                            val.cardUserId ||
+                            val.filePath ||
+                            (Array.isArray(val.files) && val.files.length > 0),
+                        ),
+                    "Provide at least one of text, filePath, files, link, or cardUserId",
                 )
-                .refine(
-                    (val) => !(val.link && val.cardUserId),
-                    "Cannot send both link and cardUserId in a single call",
-                ),
+                .refine((val) => {
+                    const hasFile = Boolean(val.filePath || (Array.isArray(val.files) && val.files.length > 0));
+                    const modes = [Boolean(val.link), Boolean(val.cardUserId), hasFile].filter(Boolean).length;
+                    return modes <= 1;
+                }, "Cannot combine link, cardUserId, and file attachments in a single call"),
         },
         async ({
             threadId: threadIdIn,
             text,
+            filePath,
+            files,
             link,
             cardUserId,
             threadType: threadTypeIn,
@@ -577,8 +618,44 @@ export function registerTools(server, api, buffer, filter, config, nameCache, ac
                     });
                 }
 
+                const rawFiles = [...(filePath ? [filePath] : []), ...(Array.isArray(files) ? files : [])];
+                if (rawFiles.length > 0) {
+                    const absPaths = rawFiles.map((p) => resolve(String(p).trim()));
+                    const missing = absPaths.filter((p) => !existsSync(p));
+                    if (missing.length > 0) {
+                        return err(`File not found: ${missing.join(", ")}`);
+                    }
+                    const result = await api.sendMessage(
+                        { msg: text || "", attachments: absPaths },
+                        threadId,
+                        Number(threadType),
+                    );
+                    const rawAtt = result?.attachment;
+                    const attRows = rawAtt ? (Array.isArray(rawAtt) ? rawAtt : [rawAtt]) : [];
+                    const sent = attRows
+                        .filter((r) => (r?.msgId ?? null) !== null)
+                        .map((r) => ({
+                            msgId: String(r.msgId),
+                            cliMsgId: (r.cliMsgId ?? null) === null ? null : String(r.cliMsgId),
+                        }));
+                    const messageId =
+                        result?.message?.msgId ?? result?.msgId ?? (sent.length > 0 ? sent[0].msgId : null);
+                    const cliMsgId =
+                        result?.message?.cliMsgId ?? result?.cliMsgId ?? (sent.length > 0 ? sent[0].cliMsgId : null);
+                    return ok({
+                        success: true,
+                        kind: "attachment",
+                        files: absPaths,
+                        sent,
+                        messageId,
+                        ...(cliMsgId !== null && { cliMsgId: String(cliMsgId) }),
+                        threadType,
+                        ...(thread.notice && { threadId, notice: thread.notice }),
+                    });
+                }
+
                 if (!text) {
-                    return err("Provide text, link, or cardUserId.");
+                    return err("Provide text, filePath, files, link, or cardUserId.");
                 }
 
                 const warnings = [];
@@ -2489,4 +2566,287 @@ export function registerTools(server, api, buffer, filter, config, nameCache, ac
             }
         },
     );
+
+    // --- zalo_friend ---
+    server.registerTool(
+        "zalo_friend",
+        {
+            title: "Manage Zalo Friends and Friend Requests",
+            description:
+                "Check, list and answer friend requests, and list friends. Actions: " +
+                "'status' (the relationship with userId: is_friend, and is_requested / is_requesting, Zalo's two flags " +
+                "for a request pending between you and them; to tell which direction a request goes, use the two lists), " +
+                "'sent_requests' (requests you sent that are still pending), " +
+                "'received_requests' (requests others sent you, newest first, with their message), " +
+                "'send' (friend request to userId, with an optional message), " +
+                "'accept' / 'reject' (the request from userId), " +
+                "'undo' (cancel the request you sent to userId), " +
+                "'list' (your friends, most recently active first, capped by limit). " +
+                "userId is the numeric Zalo id (zalo_lookup_user finds one from a phone number). " +
+                "Zalo restricts accounts that send many friend requests, so send sparingly.",
+            inputSchema: z.object({
+                action: z
+                    .enum(["status", "sent_requests", "received_requests", "send", "accept", "reject", "undo", "list"])
+                    .describe("Friend operation to perform"),
+                userId: z
+                    .string()
+                    .min(1)
+                    .optional()
+                    .describe("Numeric Zalo user id (required for status, send, accept, reject and undo)"),
+                message: z
+                    .string()
+                    .optional()
+                    .describe("Message sent with the friend request (only for 'send'; default: none)"),
+                limit: z
+                    .number()
+                    .int()
+                    .min(1)
+                    .max(1000)
+                    .optional()
+                    .describe(
+                        "Most friends to return for 'list' (default 200; the reply says how many there are in all)",
+                    ),
+            }),
+        },
+        async ({ action, userId, message, limit }) => {
+            const needsUser = ["status", "send", "accept", "reject", "undo"].includes(action);
+            const target = userId === undefined ? "" : String(userId).trim();
+            if (needsUser) {
+                if (!target) return err(`userId is required for action='${action}'.`);
+                if (!/^\d{1,30}$/.test(target)) {
+                    return err(
+                        `userId must be a numeric Zalo id (got "${target}"). zalo_lookup_user finds one from a phone number.`,
+                    );
+                }
+            }
+            try {
+                switch (action) {
+                    case "status":
+                        return ok({ action, ...friendStatusFrom(await api.getFriendRequestStatus(target), target) });
+                    case "sent_requests": {
+                        let res = null;
+                        try {
+                            res = await api.getSentFriendRequest();
+                        } catch (e) {
+                            // Zalo answers code 112 when there are none, which is an empty list, not a failure.
+                            if (!/\b112\b/.test(String(e?.message))) throw e;
+                        }
+                        const requests = sentRequestsFrom(res);
+                        return ok({ action, count: requests.length, requests });
+                    }
+                    case "received_requests": {
+                        const requests = receivedRequestsFrom(await api.getFriendRecommendations());
+                        return ok({ action, count: requests.length, requests });
+                    }
+                    case "send":
+                        await api.sendFriendRequest(message ?? "", target);
+                        return ok({ action, success: true, userId: target });
+                    case "accept":
+                        await api.acceptFriendRequest(target);
+                        return ok({ action, success: true, userId: target });
+                    case "reject":
+                        await api.rejectFriendRequest(target);
+                        return ok({ action, success: true, userId: target });
+                    case "undo":
+                        await api.undoFriendRequest(target);
+                        return ok({ action, success: true, userId: target });
+                    case "list": {
+                        const { total, friends } = friendsFrom(await api.getAllFriends(), limit ?? 200);
+                        return ok({ action, total, count: friends.length, truncated: friends.length < total, friends });
+                    }
+                    default:
+                        return err(`Unsupported friend action: ${action}`);
+                }
+            } catch (e) {
+                console.error("[mcp-tools] zalo_friend error:", e.message);
+                // 'send' keeps the CLI's wording for Zalo's refusal codes (already friends, blocked, ...).
+                const known =
+                    action === "send" ? describeFriendAddError(e.code ?? extractErrorCode(e.message), target) : null;
+                return err(known || e.message);
+            }
+        },
+    );
+
+    // --- zalo_group ---
+    server.registerTool(
+        "zalo_group",
+        {
+            title: "Manage Zalo Groups",
+            description:
+                "Leave, inspect, create and change the membership of a group (zalo_get_group_members lists who is " +
+                "in one). Actions: " +
+                "'info' (the group's name, description, creator, admins, member count and limit, creation time and " +
+                "settings), " +
+                "'create' (a new group named `name` with the members in userIds), " +
+                "'add_members' (add userIds to the group), " +
+                "'remove_member' (remove the one member userId from the group), " +
+                "'leave' (leave the group; `silent` hides the usual notice from ordinary members; the owner still sees it). " +
+                "groupId is the group's thread id (zalo_search_threads or zalo_list_conversations finds it); " +
+                "user ids are numeric Zalo ids (zalo_lookup_user finds one from a phone number). " +
+                "'leave' and 'remove_member' cannot be undone from here, so they need confirm: true (a plain " +
+                "parameter, no prompt; a deployment can turn the check off with groupConfirm: false in " +
+                "mcp-config.json or ZALO_MCP_GROUP_CONFIRM=0). Zalo can refuse some members " +
+                "of a create or add_members: the reply lists the members it did and did not take.",
+            inputSchema: z.object({
+                action: z
+                    .enum(["leave", "info", "create", "add_members", "remove_member"])
+                    .describe("Group operation to perform"),
+                groupId: z
+                    .string()
+                    .min(1)
+                    .optional()
+                    .describe("The group's id (required for leave, info, add_members and remove_member)"),
+                name: z.string().optional().describe("The new group's name (required for 'create')"),
+                userIds: z
+                    .array(z.string().min(1))
+                    .min(1)
+                    .max(100)
+                    .optional()
+                    .describe("Numeric Zalo user ids (required for 'create' and 'add_members')"),
+                userId: z.string().min(1).optional().describe("Numeric Zalo user id (required for 'remove_member')"),
+                silent: z
+                    .boolean()
+                    .optional()
+                    .describe(
+                        "Only for 'leave': hide the usual notice from ordinary members; the owner still sees it (default false)",
+                    ),
+                confirm: z
+                    .boolean()
+                    .optional()
+                    .describe(
+                        "Must be true for 'leave' and 'remove_member', which cannot be undone from here " +
+                            "(ignored when the deployment has switched the check off)",
+                    ),
+            }),
+        },
+        async ({ action, groupId, name, userIds, userId, silent, confirm }) => {
+            const gid = groupId === undefined ? "" : String(groupId).trim();
+            if (["leave", "info", "add_members", "remove_member"].includes(action)) {
+                if (!gid) return err(`groupId is required for action='${action}'.`);
+                if (!/^\d{1,30}$/.test(gid)) {
+                    return err(
+                        `groupId must be a numeric Zalo group id (got "${gid}"). zalo_search_threads finds one by name.`,
+                    );
+                }
+            }
+            const badId = (id) => !/^\d{1,30}$/.test(id);
+            let members = [];
+            if (action === "create" || action === "add_members") {
+                members = [...new Set((userIds ?? []).map((u) => String(u).trim()))];
+                if (members.length === 0) return err(`userIds is required for action='${action}'.`);
+                const bad = members.find(badId);
+                if (bad !== undefined) {
+                    return err(
+                        `userIds must be numeric Zalo ids (got "${bad}"). zalo_lookup_user finds one from a phone number.`,
+                    );
+                }
+            }
+            const target = userId === undefined ? "" : String(userId).trim();
+            if (action === "remove_member") {
+                if (!target) return err("userId is required for action='remove_member'.");
+                if (badId(target)) {
+                    return err(
+                        `userId must be a numeric Zalo id (got "${target}"). zalo_get_group_members lists a group's members.`,
+                    );
+                }
+            }
+            const groupName = name === undefined ? "" : String(name).trim();
+            if (action === "create" && !groupName) return err("name is required for action='create'.");
+
+            // After validation, before Zalo: a refused call changes nothing and says exactly how to retry.
+            if (CONFIRMED_ACTIONS.includes(action) && confirm !== true && groupConfirmRequired({ config })) {
+                const what = action === "leave" ? `leave group ${gid}` : `remove ${target} from group ${gid}`;
+                return err(
+                    `Not done: this would ${what}, which cannot be undone from here. Repeat the call with ` +
+                        "confirm: true to proceed. (An automatic or headless deployment can turn this check off " +
+                        "with groupConfirm: false in mcp-config.json, or ZALO_MCP_GROUP_CONFIRM=0 in the environment.)",
+                );
+            }
+
+            try {
+                switch (action) {
+                    case "info": {
+                        const info = groupInfoFrom(await api.getGroupInfo([gid]), gid);
+                        if (!info) {
+                            return err(
+                                `Zalo's answer does not include group ${gid}: this account is not in it, or it is not ` +
+                                    "a group id (a 1-1 conversation's id is the other person's uid).",
+                            );
+                        }
+                        return ok({ action, ...info });
+                    }
+                    case "create": {
+                        const made = createdGroupFrom(await api.createGroup({ name: groupName, members }), members);
+                        if (!made.groupId)
+                            return err("Zalo did not return a group id; the group may not have been created.");
+                        return ok({
+                            action,
+                            groupId: made.groupId,
+                            name: groupName,
+                            added: made.added,
+                            failed: made.failed,
+                        });
+                    }
+                    case "add_members": {
+                        const change = memberChangeFrom(await api.addUserToGroup(members, gid), members);
+                        if (change.done.length === 0) {
+                            const why = change.errorData
+                                ? ` (Zalo's error codes: ${JSON.stringify(change.errorData)})`
+                                : "";
+                            return err(
+                                `Zalo did not add any of the ${members.length} member(s) to group ${gid}${why}.`,
+                            );
+                        }
+                        return ok({
+                            action,
+                            groupId: gid,
+                            added: change.done,
+                            failed: change.failed,
+                            ...(change.errorData && { errorData: change.errorData }),
+                        });
+                    }
+                    case "remove_member": {
+                        const change = memberChangeFrom(await api.removeUserFromGroup([target], gid), [target]);
+                        if (change.failed.length > 0) {
+                            return err(
+                                `Zalo did not remove ${target} from group ${gid}: not a member, or this account is not ` +
+                                    "allowed to remove members (a group's owner or an admin can).",
+                            );
+                        }
+                        return ok({ action, success: true, groupId: gid, userId: target });
+                    }
+                    case "leave": {
+                        const quiet = silent === true;
+                        const res = await api.leaveGroup(gid, quiet);
+                        const memberError = Array.isArray(res?.memberError) ? res.memberError : [];
+                        return ok({
+                            action,
+                            success: true,
+                            groupId: gid,
+                            silent: quiet,
+                            ...(memberError.length > 0 && { memberError }),
+                        });
+                    }
+                    default:
+                        return err(`Unsupported group action: ${action}`);
+                }
+            } catch (e) {
+                console.error("[mcp-tools] zalo_group error:", e.message);
+                if (action === "leave" && NOT_A_MEMBER_CODES.includes(Number(e.code ?? extractErrorCode(e.message)))) {
+                    return err(
+                        `This account is not in group ${gid} (already left, or never joined), so there is nothing to leave.`,
+                    );
+                }
+                if (
+                    action === "remove_member" &&
+                    Number(e.code ?? extractErrorCode(e.message)) === REMOVE_NOT_IN_GROUP
+                ) {
+                    return err(
+                        `Zalo says ${target} is not in group ${gid} ("${e.message}", code ${REMOVE_NOT_IN_GROUP}).`,
+                    );
+                }
+                return err(e.message);
+            }
+        },
+    );
 }

package/src/utils/cli-args.js

@@ -0,0 +1,84 @@
+/**
+ * Small argument parsers for the commands that wrap a zca-js call taking an
+ * enum or a boolean: typing indicator, report, active status, language.
+ *
+ * Each throws an Error whose message says what was accepted, so the command's
+ * catch block can print it as the usage error. None touches Zalo.
+ */
+import { ReportReason, UpdateLangAvailableLanguages } from "zca-js";
+
+/**
+ * `--type <n>`: 0 = user, 1 = group.
+ *
+ * @param {string|number} value
+ * @returns {0|1}
+ * @throws {Error} for anything else
+ */
+export function parseThreadTypeArg(value) {
+    const s = String(value).trim();
+    if (s === "0") return 0;
+    if (s === "1") return 1;
+    throw new Error(`--type must be 0 (user) or 1 (group), got "${value}"`);
+}
+
+/**
+ * `on` / `off` (also true/false, 1/0, yes/no, enable/disable).
+ *
+ * @param {string} value
+ * @param {string} [what] - the setting's name, for the error message
+ * @returns {boolean}
+ * @throws {Error} for anything else
+ */
+export function parseOnOff(value, what = "value") {
+    const s = String(value).trim().toLowerCase();
+    if (["on", "true", "1", "yes", "enable", "enabled"].includes(s)) return true;
+    if (["off", "false", "0", "no", "disable", "disabled"].includes(s)) return false;
+    throw new Error(`${what} must be "on" or "off", got "${value}"`);
+}
+
+/**
+ * `vi` / `en`, as zca-js's `updateLang` takes them (it sends `VI` / `EN`).
+ *
+ * @param {string} value
+ * @returns {string} an UpdateLangAvailableLanguages value
+ * @throws {Error} for any other language
+ */
+export function parseLanguage(value) {
+    const key = String(value).trim().toUpperCase();
+    if (key in UpdateLangAvailableLanguages) return UpdateLangAvailableLanguages[key];
+    throw new Error(`language must be one of: ${Object.keys(UpdateLangAvailableLanguages).join(", ").toLowerCase()}`);
+}
+
+/** The reasons `msg report` accepts, by name. */
+export const REPORT_REASONS = Object.freeze({
+    sensitive: ReportReason.Sensitive,
+    annoy: ReportReason.Annoy,
+    fraud: ReportReason.Fraud,
+    other: ReportReason.Other,
+});
+
+/**
+ * The options object zca-js's `sendReport` takes.
+ *
+ * `other` is the only reason that carries text, and zca-js sends it only for
+ * that reason, so a text given with another reason would be dropped without a
+ * word: refuse it instead of pretending it was reported.
+ *
+ * @param {string} reason - sensitive | annoy | fraud | other
+ * @param {string} [content] - required with `other`, refused otherwise
+ * @returns {{reason: number, content?: string}}
+ * @throws {Error} for an unknown reason, `other` without text, or text with any other reason
+ */
+export function parseReportReason(reason, content) {
+    const key = String(reason).trim().toLowerCase();
+    if (!(key in REPORT_REASONS)) {
+        throw new Error(`--reason must be one of: ${Object.keys(REPORT_REASONS).join(", ")}, got "${reason}"`);
+    }
+    const text = content === undefined ? "" : String(content).trim();
+    if (key === "other") {
+        if (!text) throw new Error('--reason other needs the details: add --content "<what happened>"');
+        return { reason: REPORT_REASONS.other, content: text };
+    }
+    if (text) throw new Error(`--content is only sent with --reason other; "${key}" carries no text`);
+    return { reason: REPORT_REASONS[key] };
+}

package/src/utils/secrets.js

@@ -0,0 +1,69 @@
+/**
+ * Secrets that arrive as command-line flags: masking them for logs, and
+ * resolving the webhook signing secret from its three sources.
+ */
+
+/** Flags whose value is a secret and must never be written to a log. */
+export const SECRET_FLAGS = Object.freeze(["--auth", "--client-secret", "--webhook-secret"]);
+
+/**
+ * A copy of an argument list with every secret flag's value replaced by `***`.
+ *
+ * Handles both `--auth value` and `--auth=value`. The launcher for `-d` writes
+ * its argument list into `daemon.log` ("starting daemon: ..."), and a bearer
+ * token or signing secret has no business in a log that gets shipped or
+ * attached to an issue.
+ *
+ * @param {string[]} args
+ * @returns {string[]} a new array; the input is not modified
+ */
+export function maskSecretArgs(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = String(args[i]);
+        const eq = a.indexOf("=");
+        if (eq > 0 && SECRET_FLAGS.includes(a.slice(0, eq))) {
+            out.push(`${a.slice(0, eq)}=***`);
+        } else if (SECRET_FLAGS.includes(a) && i + 1 < args.length) {
+            out.push(a, "***");
+            i++;
+        } else {
+            out.push(a);
+        }
+    }
+    return out;
+}
+
+/**
+ * The webhook signing secret: the `--webhook-secret` flag, else the
+ * `ZALO_WEBHOOK_SECRET[_<ownId>]` environment variable, else the MCP config's
+ * `webhookSecret`. Null when none is set, which means unsigned webhooks.
+ *
+ * A flag that is present but empty throws instead of falling through: an
+ * unset shell variable (`--webhook-secret "$SECRET"`) is how an empty value
+ * arrives, and falling back to "no secret" would silently send unsigned
+ * webhooks to a receiver that believes it is verifying signatures.
+ *
+ * @param {object} sources
+ * @param {string|undefined} [sources.flag] - the parsed `--webhook-secret` value
+ * @param {string|null|undefined} [sources.env] - the environment variable's value
+ * @param {string|null|undefined} [sources.config] - `webhookSecret` from mcp-config.json
+ * @returns {string|null}
+ * @throws {Error} when the flag is given empty
+ */
+export function resolveWebhookSecret({ flag, env, config } = {}) {
+    if (flag !== undefined) {
+        const s = String(flag).trim();
+        if (!s) {
+            throw new Error(
+                "--webhook-secret was given an empty secret. Refusing to start: webhooks would go out unsigned " +
+                    "while the receiver expects signatures.",
+            );
+        }
+        return s;
+    }
+    for (const v of [env, config]) {
+        if (typeof v === "string" && v.trim()) return v.trim();
+    }
+    return null;
+}

package/node_modules/zca-js/dist/apis/deleteSnapshotMobileMsg.js

@@ -1,18 +0,0 @@
-import { ZaloApiError } from "../Errors/ZaloApiError.js";
-import { apiFactory } from "../utils.js";
-
-export const deleteSnapshotMobileMsgFactory = apiFactory()((api, ctx, utils) => {
-    const serviceURL = utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/delete_snapshot_mobile_msg`);
-    return async function deleteSnapshotMobileMsg(publicKey) {
-        const params = {
-            public_key: publicKey,
-            imei: ctx.imei
-        };
-        const encryptedParams = utils.encodeAES(JSON.stringify(params));
-        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
-        const response = await utils.request(`${serviceURL}&params=${encodeURIComponent(encryptedParams)}`, {
-            method: "GET"
-        });
-        return utils.resolve(response);
-    };
-});

package/node_modules/zca-js/dist/apis/getCrossDB.js

@@ -1,18 +0,0 @@
-import { ZaloApiError } from "../Errors/ZaloApiError.js";
-import { apiFactory } from "../utils.js";
-
-export const getCrossDBFactory = apiFactory()((api, _, utils) => {
-    const serviceURL = utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/get_crossdb`);
-    return async function getCrossDB(syncSession) {
-        const params = {
-            pc_name: "Web",
-            sync_session: syncSession
-        };
-        const encryptedParams = utils.encodeAES(JSON.stringify(params));
-        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
-        const response = await utils.request(`${serviceURL}&params=${encodeURIComponent(encryptedParams)}`, {
-            method: "GET"
-        });
-        return utils.resolve(response);
-    };
-});

package/node_modules/zca-js/dist/apis/pullMobileMsg.js

@@ -1,22 +0,0 @@
-import { ZaloApiError } from "../Errors/ZaloApiError.js";
-import { apiFactory } from "../utils.js";
-
-export const pullMobileMsgFactory = apiFactory()((api, _, utils) => {
-    const serviceURL = utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/pull_mobile_msg`);
-    return async function pullMobileMsg(publicKey, fromSeqId = 0, isRetry = 0, tempKey = "") {
-        const params = {
-            pc_name: "Web",
-            public_key: publicKey,
-            from_seq_id: fromSeqId,
-            is_retry: isRetry,
-            min_seq_id: 0,
-            temp_key: tempKey
-        };
-        const encryptedParams = utils.encodeAES(JSON.stringify(params));
-        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
-        const response = await utils.request(`${serviceURL}&params=${encodeURIComponent(encryptedParams)}`, {
-            method: "GET"
-        });
-        return utils.resolve(response);
-    };
-});